# DNS-01 验证示例：查看域名的 ACME DNS 记录
dig _acme-challenge.example.com TXT

# 查看 OV 证书中的组织信息
echo | openssl s_client -connect github.com:443 2>/dev/null \
  | openssl x509 -noout -subject -issuer
# subject=CN=github.com
# issuer=C=US, O=DigiCert Inc, CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1

# 查看 EV 证书的扩展信息
echo | openssl s_client -connect www.apple.com:443 2>/dev/null \
  | openssl x509 -noout -text | grep -A2 "Certificate Policies"

# EV 证书通常包含 CA/Browser Forum 的 EV 策略 OID
# 2.23.140.1.1 (EV Guidelines)

# 查看通配符证书的 SAN
echo | openssl s_client -connect "*.example.com:443" 2>/dev/null \
  | openssl x509 -noout -text | grep -A5 "Subject Alternative Name"

# 查看证书的 SAN 信息
echo | openssl s_client -connect www.google.com:443 -servername www.google.com 2>/dev/null \
  | openssl x509 -noout -text | grep -A20 "Subject Alternative Name"

# 输出示例（Google 的证书包含大量域名）：
# X509v3 Subject Alternative Name:
#     DNS:*.google.com, DNS:*.android.com, DNS:*.appengine.google.com,
#     DNS:*.cloud.google.com, DNS:google.com, ...

# 检查证书的 Key Usage
echo | openssl s_client -connect www.baidu.com:443 2>/dev/null \
  | openssl x509 -noout -text | grep -A2 "Extended Key Usage"

# 输出:
# X509v3 Extended Key Usage:
#     TLS Web Server Authentication, TLS Web Client Authentication

# 查看已签名的可执行文件（Windows Authenticode）
# Linux 上使用 osslsigncode 工具
osslsigncode verify /path/to/signed-binary.exe

# Nginx 配置 mTLS
# ssl_client_certificate /etc/nginx/ssl/client-ca.crt;
# ssl_verify_client on;

# 生成客户端证书
openssl req -new -x509 -days 365 \
  -key client.key -out client.crt \
  -subj "/CN=client@example.com"

# 使用客户端证书访问
curl --cert client.crt --key client.key https://example.com

# 查看 S/MIME 证书信息
openssl pkcs12 -in smime.p12 -info -nokeys

# 方法 1：单条命令（RSA）
openssl req -x509 -newkey rsa:2048 -nodes \
  -keyout selfsigned.key -out selfsigned.crt \
  -days 365 \
  -subj "/C=CN/ST=Beijing/O=MyOrg/CN=localhost"

# 方法 2：使用 ECDSA（更快、更小）
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 \
  -keyout selfsigned-ec.key -out selfsigned-ec.crt \
  -days 365 \
  -subj "/C=CN/ST=Beijing/O=MyOrg/CN=localhost"

# 查看生成的证书
openssl x509 -in selfsigned.crt -noout -text | head -15

# 创建配置文件
cat > san.cnf << 'EOF'
[req]
distinguished_name = req_dn
x509_extensions = v3_ext
prompt = no

[req_dn]
C = CN
ST = Beijing
O = MyOrg
CN = myapp.local

[v3_ext]
subjectAltName = @alt_names
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth

[alt_names]
DNS.1 = myapp.local
DNS.2 = *.myapp.local
DNS.3 = localhost
IP.1 = 127.0.0.1
IP.2 = ::1
EOF

# 生成证书
openssl req -x509 -newkey rsa:2048 -nodes \
  -keyout myapp.key -out myapp.crt \
  -days 365 -config san.cnf

# 验证 SAN
openssl x509 -in myapp.crt -noout -text | grep -A5 "Subject Alternative Name"

# 浏览器对自签名证书的处理
curl -k https://selfsigned.example.com  # -k 忽略证书验证
# 或者将自签名证书添加到信任存储

# ⚠️ 生产环境切勿使用 -k 参数，它会绕过所有证书验证

# PEM → DER
openssl x509 -in cert.pem -outform DER -out cert.der

# DER → PEM
openssl x509 -in cert.der -inform DER -outform PEM -out cert.pem

# PEM + Key → PKCS#12
openssl pkcs12 -export \
  -in cert.pem -inkey key.pem \
  -out cert.p12 \
  -name "my-cert" \
  -passout pass:mypassword

# PKCS#12 → PEM（提取证书和私钥）
openssl pkcs12 -in cert.p12 -out cert_extracted.pem -nodes -passin pass:mypassword

# 从 PKCS#12 中只提取证书
openssl pkcs12 -in cert.p12 -clcerts -nokeys -out cert_only.pem -passin pass:mypassword

# 从 PKCS#12 中只提取私钥
openssl pkcs12 -in cert.p12 -nocerts -out key_only.pem -passin pass:mypassword

# PEM → PKCS#7（证书链）
openssl crl2pkcs7 -nocrl -certfile leaf.pem -certfile intermediate.pem -out chain.p7b

# PKCS#7 → PEM
openssl pkcs7 -in chain.p7b -print_certs -out chain.pem

# RSA 密钥
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out rsa.key

# ECDSA 密钥（P-256）
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out ecdsa.key

# Ed25519 密钥
openssl genpkey -algorithm Ed25519 -out ed25519.key

# 比较密钥大小
ls -la rsa.key ecdsa.key ed25519.key

# 查看密钥信息
openssl pkey -in ecdsa.key -text -noout | head -5